what regex command i can use in order to create a field in splunk

[s0m073r]

I have a data which splunk shows, but i dont see a field for what i wanted

"ag-somethin-id":["97234d506-E0ASD-4XXX-AXX0-ASD77757"]

I need to to create a field with ag-somethin-id which should actually give me the all the values under those events and it should show something like:

97234d506-E0ASD-4XXX-AXX0-ASD77757 under this field ag-somethin-id

Till now I have tried using the below, but its not correct:

rex "ag-somethin-id[\\":](?[^\[":"])"

Please help in fixing this

[richgalloway · Accepted solution]

This worked for me in regex101.com using your sample data.

rex "ag-somethin-id\":\[\"(?<somethin>[^\"]+)"